How do you give a SageMaker AI job access to one S3 bucket only?
Why D is the answer
An IAM execution role scoped to that bucket
Use a least-privilege execution role.
In detail
- A scoped execution role gives access to that bucket only.
- Avoid wildcards in the policy.
Use case
An illustrative scenario, not a real incident.
A training job can read one S3 bucket, because its execution role allows only that bucket.
See it in different ways
flowchart TD A["Secure ML workload"] --> B["VPC and private endpoints"] A --> C["Least-privilege IAM roles"] A --> D["KMS encryption at rest"] A --> E["TLS in transit"]
mindmap
root((Security))
Access
IAM execution role
Network
VPC interface endpoint
Data
KMS customer managed keys
Audit
CloudTrailflowchart LR S0["Create role"] --> S1["Allow one bucket"] --> S2["Assign to the job"]
Key point: Scope the execution role.
Why the other options are wrong
- A. The account root user's access keys
- Root keys should not be used.
- B. A public bucket policy
- A public policy exposes the bucket.
- C. A password in the training script
- Code should not hold passwords.